Capping what an approval can spend
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
An unlimited approval covers not only what you hold now but whatever arrives later. If your wallet lets you set a cap, cap it at the amount this transaction needs. It costs a little more gas, and in return you decide the maximum possible loss.
Key points
- An approval is a standing permission; nothing leaves at signing time, which is why it goes unnoticed
- An unlimited approval extends to tokens you receive in future
- A capped approval limits any abuse to that amount
- Capping means approving again on later trades, so gas costs rise
Definition
Setting the allowance granted in a token approval to the amount actually required, rather than accepting the unlimited default.
The first thing a decentralised exchange or DeFi app asks you to sign is an approval. That is a legitimate step, letting the service's contract move your tokens. The problem is the default: to avoid making you re-sign on every later action, most apps propose an unlimited allowance. Convenient, yes; proportionate as a grant of authority, no.
Concretely, an unlimited approval means that contract can move all of that token, at any time. It includes staking rewards you receive later and anything you buy afterwards. In documented abuse, attackers obtained the approval, did nothing for a while, and drained the wallet once the balance had grown. 'Nothing happened right after I approved' is not evidence of safety.
The fix is to set a cap. Most major wallets let you edit the amount in the approval prompt: set it to what this swap needs, or a little above. The cost is that the next time you use the service you will approve again and pay the gas. That is the trade-off, and a reasonable split is to accept unlimited on a large service you use constantly, while always capping on a service you are trying for the first time or a small app.
Capping only pays off in combination with reviewing and revoking approvals, because the approval itself persists regardless. Revoke once you have finished with a service, and check the list at least every few months. Note that setting the allowance to zero is what revoking an approval actually means.
Watch out for
- · A capped approval is still a standing one until you revoke it
- · For services you already granted unlimited allowances to, review the list in an approval manager
- · Check that the address being authorised belongs to the service you are actually using
Frequently asked questions
If capping costs more gas, why not just leave it unlimited?
It depends on how often you trade and how much you hold. On a large service you use constantly, unlimited can be a reasonable call. For an app you are trying for the first time, or a contract whose provenance you have not established, the cap is worth more than the gas.